Privacy policy

You can use these same contact details for any question about your personal data.

We only ask for the data needed for each request. Mandatory fields are marked in every form; if you leave them blank, we cannot process your request. If you give us your email address, we will send you a message summarising your request. We do not use form data to send you advertising.

Booking requests

We process your name, your contact details (telephone and email), the date, time and number of guests, and any comments you add, in order to handle your request, confirm your table by phone or email and look after you on the day of your visit.

Online bookings with TheFork

Online bookings on our reservations page are made in TheFork's booking module, embedded in our website. The data you enter in that module (for example, your name, contact details, the date, time, number of guests and your comments) is collected by TheFork, which processes it under its own privacy policy and passes it on to us so that we can handle your booking and look after you on the day of your visit.

Professionals' discount

In addition to the booking details, this form collects your professional sector and your workplace or institution, so that we can check that the request falls within the campaign conditions. Your professional accreditation and DNI or NIE are only shown at the restaurant: we do not ask you to send us copies of documents or identification numbers. The question "How did you hear about us?" is optional; we use the answers in aggregate to find out which communication channels work.

Corporate and group dining

We process your name, your contact details, the date, the number of guests, your preferred time or service, the type of occasion and, if you provide them, your company and comments, in order to send you a proposal with the menu and terms and, if you accept it, to organise the group booking.

Catering quotes

We process the event details (format, type of event, date, time, number of guests, venue, chosen service, equipment and duration or sharing boxes, and any dietary requirements you indicate), your name, telephone number and email address and, if you provide them, your company and comments, in order to prepare your personalised quotation and, if you accept it, to provide and invoice the service.

Enquiries by phone or email

If you call or write to us, we use the information you give us to reply and, where relevant, to handle the booking, order or quotation you request.

Dietary requirements

Some optional fields, such as comments or the dietary requirements in the catering form, let you tell us about allergies, intolerances or dietary preferences (for example, the halal option). Giving us this information is always voluntary. If you do, we will use it solely to prepare your booking, proposal or quotation and to serve you safely, never to build profiles or for advertising.

Website security

To protect our forms against spam and abuse, we record with each request the date and time it was sent, your browser details (user agent) and a pseudonymised (hashed) value of your IP address; we never store your full IP address with your request. Our hosting provider also processes technical connection data to keep the service available and secure.

Where your visit came from

With each request we store the website language, the page you landed on, the referring website and, if you arrived through a campaign link (for example, from Instagram or Facebook), that link's reference. We use this information in aggregate to see which channels bring us requests.

Usage statistics

Only if you accept analytics cookies do we use Google Analytics 4 to obtain statistics on how the website is used. We never send Google Analytics your name, email address, telephone number, workplace or comments: when you submit a form, we only record the submission with general details, such as the type of request or, if you answer it, your reply to "How did you hear about us?". More information in our cookie policy.

• Booking, professionals' discount, group and catering requests, and related enquiries: taking steps at your request prior to entering into a contract and, once you accept the booking, proposal or quotation, performance of the contract (Article 6(1)(b) GDPR).
• Online bookings with TheFork: handling the booking you make, as a step taken at your request prior to entering into a contract and to provide the service (Article 6(1)(b) GDPR).
• Invoicing and keeping accounting records: compliance with legal obligations (Article 6(1)(c) GDPR).
• Details of a company's contact person: our legitimate interest in maintaining the relationship with that company (Article 6(1)(f) GDPR and Article 19 LOPDGDD).
• General enquiries not related to a booking or quotation: our legitimate interest in replying to people who contact us (Article 6(1)(f) GDPR).
• Website security and abuse prevention: our legitimate interest in protecting our systems and our users (Article 6(1)(f) GDPR).
• Where your visit came from and answers to "How did you hear about us?": our legitimate interest in understanding how effective our communication channels are (Article 6(1)(f) GDPR).
• Google Analytics statistics: your consent (Article 6(1)(a) GDPR and Article 22(2) LSSI-CE), which you can withdraw at any time via Cookie settings.
• Allergies, intolerances or dietary preferences you tell us about: your explicit consent (Article 9(2)(a) GDPR), which you can withdraw at any time.

You can object to processing based on legitimate interest by writing to info@campisismarbella.es. The box you tick in the form confirms that you have read this policy and want us to handle your request; we do not treat it as consent for any other purpose, such as sending you advertising.

We do not disclose your data to third parties unless the law requires us to (for example, to the tax authorities, courts or law enforcement agencies).

To run the service, we work with providers that process data on behalf of CAMPISIS SL under data processing agreements in accordance with Article 28 GDPR:

• Amazon Web Services EMEA SARL (Luxembourg): hosting of the website, the database and the forms, and sending of the related emails, on servers located in the European Union.
• Cloudflare, Inc. (United States): DNS management for our domains.
• Google Ireland Limited (Ireland): Google Analytics 4, only if you accept analytics cookies.

Online bookings on our website are made with TheFork: the data you enter in its booking module is collected by TheFork, which passes the details of your booking on to us. How TheFork processes that data, and with whom it shares it, is explained in its privacy policy, available on its website.

If you order or book through a third-party platform (for example, a delivery platform), that platform processes your data under its own privacy policy; we only receive the data needed to prepare your order or look after your booking.

The website, the database and the forms are hosted on servers in the European Union. However, Amazon Web Services, Cloudflare and Google belong to groups headquartered in the United States and operate global networks, so some data (for example, technical connection data or Google Analytics data) may be processed outside the European Economic Area.

In those cases, transfers are based on Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework, for the companies that participate in it, and on the standard contractual clauses approved by the European Commission. You can check the list of participating companies at dataprivacyframework.gov (opens in a new tab).

We keep data only for as long as necessary for the purpose for which it was collected:

• Booking and professionals' discount requests: while we handle the booking and, after your visit, only for as long as needed to deal with any queries or claims about it.
• Online bookings with TheFork: the booking details TheFork passes on to us, while we handle the booking and, after your visit, only for as long as needed to deal with any queries or claims about it. TheFork keeps the data it processes on its own account under its privacy policy.
• Group and catering requests that do not result in a contract: while the request remains open; after that, we delete them.
• Contracted services (groups and catering): for the duration of the relationship and, afterwards, the data needed for invoicing and accounting for six years (Article 30 of the Spanish Commercial Code and tax legislation).
• Enquiries by phone or email: for as long as needed to reply to you and deal with your request.
• Technical security data: only for as long as strictly needed to detect abuse and resolve incidents; the pseudonymised IP value attached to a request is kept with that request.
• Google Analytics data linked to your browser: up to 14 months.

When these periods end, we delete the data or, where the law requires it, keep it blocked and available only to the competent authorities for the limitation period of any possible liabilities (Article 32 LOPDGDD).

You can exercise the following rights at any time, free of charge:

• Access: find out whether we process your data and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed, among other cases.
• Objection: object to processing based on our legitimate interest.
• Restriction of processing: ask us to keep your data without using it, in the cases provided for by law.
• Portability: receive the data you gave us in a structured, commonly used format, or have us transmit it to another controller.
• Withdrawal of consent: withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before.

To exercise them, write to info@campisismarbella.es or send a letter to our registered office, stating which right you are exercising. If we have reasonable doubts about your identity, we may ask for the additional information strictly necessary to confirm it. We will reply within one month; this period may be extended by two further months for complex requests, in which case we will let you know.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es (opens in a new tab)) through its electronic office.

The request forms on this website are intended for adults. We do not knowingly collect data from children under 14; if we find that we have done so, we will delete it.

We apply technical and organisational measures appropriate to the risk: the website works only over an encrypted connection (HTTPS), access to requests is limited to authorised CAMPISIS SL staff with individual credentials, and we store IP addresses with requests only in pseudonymised form.

We may update this policy to reflect legal changes or changes to the website, for example if we add a new provider or an external booking system. The current version, with its date, will always be published on this page.